1Y0-205 · Question #30
Scenario: A StoreFront store supports 150 users who have full access to all enterprise resources. A Citrix Administrator needs to create a new StoreFront store for contractors who will work onsite…
The correct answer is B. Unauthenticated. Unauthenticated access is the correct choice because it allows StoreFront to serve published resources to users who have no Active Directory accounts - exactly the situation with these contractors. The admin can scope which specific applications are published to this store…
Question
Scenario: A StoreFront store supports 150 users who have full access to all enterprise resources. A Citrix Administrator needs to create a new StoreFront store for contractors who will work onsite for two months. The contractors need access to specific resources but will NOT be Active Directory users. Which option should the administrator select while creating the store for contractors?
Options
- AHTTP Basic
- BUnauthenticated
- CSmart card
- DPass-through
How the community answered
(19 responses)- A5% (1)
- B79% (15)
- C11% (2)
- D5% (1)
Explanation
Unauthenticated access is the correct choice because it allows StoreFront to serve published resources to users who have no Active Directory accounts - exactly the situation with these contractors. The admin can scope which specific applications are published to this store, satisfying the requirement for limited, targeted access without provisioning AD accounts.
Why the distractors are wrong:
- A. HTTP Basic still requires credentials validated against a directory (typically AD or LDAP), so contractors without AD accounts cannot authenticate.
- C. Smart card requires a PKI certificate that maps to an existing AD account, making it unusable for non-AD users.
- D. Pass-through forwards the user's current Windows domain logon session to StoreFront - it inherently depends on the user being an AD domain member.
Memory tip: Pair "Unauthenticated" with "outside the directory" - any time a scenario says users are not Active Directory accounts but still need resource access, Unauthenticated is your answer. The word itself is the clue: no identity to authenticate against.
Topics
Community Discussion
7
Nina C.Jan 5, 2026The correct answer is B, Unauthenticated. This option lets you create a store that grants access to specific published resources without requiring Active Directory credentials, which fits perfectly here since the contractors are not AD users. The other options all depend on some form of identity tied to AD or a certificate, so HTTP Basic still prompts for domain credentials, Pass-through pulls credentials from the user's Windows session, and Smart card requires a certificate mapped to an AD account. Unauthenticated stores are designed exactly for this kind of temporary, limited-access scenario where you want to control which resources are published to the store rather than relying on user identity for access control.
Jovan I.Dec 23, 2025I was ready to mark A because HTTP Basic lets you hand out local credentials without AD, but the question specifically says the contractors will NOT be Active Directory users at all, which means there is no credential store backing them, so Unauthenticated (B) is the only method that lets StoreFront enumerate and deliver published resources to users who have zero directory presence, typically paired with anonymous Citrix accounts on the delivery controllers.
Bao N.Dec 27, 2025Unauthenticated makes sense here, but how does StoreFront handle resource filtering without AD identity?
Nina C.Dec 27, 2025Good point, and I think the short answer is that StoreFront falls back to filtering by delivery group assignment and keywords configured on the XenApp/XenDesktop side rather than pulling group membership from AD, so the admin basically pre-scopes what the unauthenticated store can even see.
Thekla S.Jan 10, 2026B is right, unauthenticated stores skip AD entirely for anonymous access.
Yusuf A.Dec 29, 2025HTTP Basic works here because contractors need credentials without AD accounts.
Thekla S.Dec 30, 2025Yusuf, HTTP Basic sends credentials in base64 with no contextual trust signal, so App Protection never gets the device posture or IdP assertion it needs to gate the session, which is exactly why B (SAML federation with an external IdP) is correct. Contractors without AD accounts are the classic use case for a federated identity provider, not a protocol that bypasses the policy engine entirely.